Skip to content

Commit 84b7418

Browse files
sushantjraosushantjrao
authored
Create howto-create-access-control-list-for-nni.md
1 parent 47a4e9a commit 84b7418

File tree

1 file changed

+156
-0
lines changed

1 file changed

+156
-0
lines changed

‎articles/operator-nexus/howto-create-access-control-list-for-nni.md

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
---
2+
title: "Azure Operator Nexus: Create Access Control Lists (ACLs) for network-to-network interconnects and layer 3 isolation domain external networks "
3+
description: Create ACLs for network-to-network interconnects and layer 3 isolation domain external networks.
4+
author: sushantjrao
5+
ms.author: sushrao
6+
ms.service: azure-operator-nexus
7+
ms.topic: how-to
8+
ms.date: 04/18/2024
9+
ms.custom: template-how-to
10+
---
11+
12+
# Access Control List (ACL) Management for NNI
13+
14+
Access Control Lists (ACLs) are a set of rules that regulate inbound and outbound packet flow within a network. Azure's Nexus Network Fabric service offers an API-based mechanism to configure ACLs for network-to-network interconnects and layer 3 isolation domain external networks. This guide outlines the steps to create ACLs.
15+
16+
## Creating Access Control Lists (ACLs)
17+
18+
To create an ACL and define its properties, you can utilize the `az networkfabric acl create` command. Below are the steps involved:
19+
20+
1. **Install Azure CLI:**
21+
If you haven't already installed the Azure CLI, you can do so by following the instructions provided [here](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli).
22+
23+
2. **Login to Azure:**
24+
Use the following command to log in to your Azure account:
25+
```bash
26+
az login
27+
```
28+
29+
3. **Set Subscription (if necessary):**
30+
If you have multiple subscriptions and need to set one as the default, you can do so with:
31+
```bash
32+
az account set --subscription <subscription-id>
33+
```
34+
35+
4. **Create ACL:**
36+
37+
```bash
38+
az networkfabric acl create --resource-group "<resource-group>" --location "<location>" --resource-name "<acl-name>" --annotation "<annotation>" --configuration-type "<configuration-type>" --default-action "<default-action>" --match-configurations "[{matchConfigurationName:<match-config-name>,sequenceNumber:<sequence-number>,ipAddressType:<IPv4/IPv6>,matchConditions:[{ipCondition:{type:<SourceIP/DestinationIP>,prefixType:<Prefix/Exact>,ipPrefixValues:['<ip-prefix1>', '<ip-prefix2>', ...]}}],actions:[{type:<Action>}]}]"
39+
```
40+
41+
| Parameter | Description |
42+
|----------------------|----------------------------------------------------------------------|
43+
| Resource Group | Specify the resource group of your network fabric. |
44+
| Location | Define the location where the ACL will be created. |
45+
| Resource Name | Provide a name for the ACL. |
46+
| Annotation | Optionally, add a description or annotation for the ACL. |
47+
| Configuration Type | Specify whether the configuration is inline or by using a file. |
48+
| Default Action | Define the default action to be taken if no match is found. |
49+
| Match Configurations| Define the conditions and actions for traffic matching. |
50+
| Actions | Specify the action to be taken based on match conditions. |
51+
52+
53+
## Parameters usage guidance
54+
55+
The table below provides guidance on the usage of parameters when creating ACLs:
56+
57+
| Parameter | Description | Example or Range |
58+
|------------------------|------------------------------------------------------------|---------------------------------|
59+
| defaultAction | Defines default action to be taken | "defaultAction": "Permit" |
60+
| resource-group | Resource group of network fabric | nfresourcegroup |
61+
| resource-name | Name of ACL | example-ingressACL |
62+
| vlanGroups | List of VLAN groups | |
63+
| vlans | List of VLANs that need to be matched | |
64+
| match-configurations | Name of match configuration | example_acl |
65+
| matchConditions | Conditions required to be matched | |
66+
| ttlValues | TTL [Time To Live] | 0-255 |
67+
| dscpMarking | DSCP Markings that need to be matched | 0-63 |
68+
| portCondition | Port condition that needs to be matched | |
69+
| portType | Port type that needs to be matched | Example: SourcePort |
70+
| protocolTypes | Protocols that need to be matched | [tcp, udp, range[1-2, 1, 2]] |
71+
| vlanMatchCondition | VLAN match condition that needs to be matched | |
72+
| layer4Protocol | Layer 4 Protocol | should be either TCP or UDP |
73+
| ipCondition | IP condition that needs to be matched | |
74+
| actions | Action to be taken based on match condition | Example: permit |
75+
| configuration-type | Configuration type (inline or file) | Example: inline |
76+
77+
> [!NOTE]
78+
> Inline ports and inline VLANs are statically defined using azcli.
79+
> PortGroupNames and VlanGroupNames are dynamically defined.
80+
> Combining inline ports with portGroupNames is not allowed, similarly for inline VLANs and VLANGroupNames.
81+
> IPGroupNames and IpPrefixValues cannot be combined.
82+
> Egress ACLs do not support certain options like IP options, IP length, fragment, ether-type, DSCP marking, and TTL values.
83+
> Ingress ACLs do not support the following options: etherType.
84+
85+
### Example payload for ACL creation
86+
87+
```Azure CLI
88+
az networkfabric acl create --resource-group "example-rg" --location "eastus2euap" --resource-name "example-Ipv4ingressACL" --annotation "annotation" --configuration-type "Inline" --default-action "Deny" --match-configurations "[{matchConfigurationName:example-match,sequenceNumber:1110,ipAddressType:IPv4,matchConditions:[{ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}},{ipCondition:{type:DestinationIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}}],actions:[{type:Count}]}]"
89+
```
90+
91+
### Example output
92+
93+
```json
94+
{
95+
"administrativeState": "Disabled",
96+
"annotation": "annotation",
97+
"configurationState": "Succeeded",
98+
"configurationType": "Inline",
99+
"defaultAction": "Deny",
100+
"id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/Fab3LabNF-4-0/providers/Microsoft.ManagedNetworkFabric/accessControlLists/L3domain091123-Ipv4egressACL",
101+
"location": "eastus2euap",
102+
"matchConfigurations": [
103+
{
104+
"actions": [
105+
{
106+
"type": "Count"
107+
}
108+
],
109+
"ipAddressType": "IPv4",
110+
"matchConditions": [
111+
{
112+
"ipCondition": {
113+
"ipPrefixValues": [
114+
"10.18.0.124/30",
115+
"10.18.0.128/30",
116+
"10.18.30.16/30",
117+
"10.18.30.20/30"
118+
],
119+
"prefixType": "Prefix",
120+
"type": "SourceIP"
121+
}
122+
},
123+
{
124+
"ipCondition": {
125+
"ipPrefixValues": [
126+
"10.18.0.124/30",
127+
"10.18.0.128/30",
128+
"10.18.30.16/30",
129+
"10.18.30.20/30"
130+
],
131+
"prefixType": "Prefix",
132+
"type": "DestinationIP"
133+
}
134+
}
135+
],
136+
"matchConfigurationName": "example-Ipv4ingressACL ",
137+
"sequenceNumber": 1110
138+
}
139+
],
140+
"name": "example-Ipv4ingressACL",
141+
"provisioningState": "Succeeded",
142+
"resourceGroup": "Fab3LabNF-4-0",
143+
"systemData": {
144+
"createdAt": "2023-09-11T10:20:20.2617941Z",
145+
"createdBy": "[email protected]",
146+
"createdByType": "User",
147+
"lastModifiedAt": "2023-09-11T10:20:20.2617941Z",
148+
"lastModifiedBy": "[email protected]",
149+
"lastModifiedByType": "User"
150+
},
151+
"type": "microsoft.managednetworkfabric/accesscontrollists"
152+
}
153+
```
154+
155+
> [!NOTE]
156+
> After creating the ACL, make sure to note down the ACL reference ID for further reference.

0 commit comments

Comments
 (0)